WO2025085220A1 - Electronic identification verification for mobile device - Google Patents

Abstract

A method is disclosed. The method includes receiving, by a mobile device, a communication comprising identity information from an electronic identification, and transmitting an electronic ID authentication request message including the identity information to an electronic ID access control computer. The electronic ID access control computer authenticates the identity information. The method includes receiving an electronic ID authentication response message from the electronic ID access control computer indicating that the electronic identification is authentic, and in response to receiving the electronic ID authentication response message, transmitting a registration request message indicating that the electronic identification is authentic to a server computer. The registration request message includes at least one of a token associated with the mobile device and a mobile device identifier associated with the mobile device. The server computer stores a record indicating that at least one of the token and the mobile device identifier is electronic ID verified.

Description

PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 ELECTRONIC IDENTIFICATION VERIFICATION FOR MOBILE DEVICE CROSS-REFERENCES TO RELATED APPLICATIONS [0001] This is an international application of and claims benefit under 35 USC§ 119(e) to U.S. Provisional Patent Application No.63/591,716 filed October 19, 2023, and entitled "Electronic Identification Verification For Mobile Device,” the disclosure of which is incorporated by reference herein in its entirety for all purposes. BACKGROUND [0002] Mobile devices can be used as instruments for conducting transactions, both online and in-person. Credentials and/or tokens associated with an account can be provided to the mobile device for use in transactions. To activate transaction capabilities on a mobile device, a user may provide credentials and other account-related information. Data security remains a security risk. For example, data security may be compromised by a malicious actor that obtains another person’s credentials and account information. The malicious actor may register their own mobile device as an instrument linked to the other person’s account. The malicious actor may then be able to conduct transactions using the other person’s account and/or other sensitive data. [0003] Embodiments of the disclosure address this problem and other problems individually and collectively. SUMMARY [0004] One embodiment of the invention is directed to a method comprising receiving, receiving, by a mobile device, a communication comprising identity information from an electronic identification; transmitting, by the mobile device, an electronic ID authentication request message including the identity information to an electronic ID access control computer, thereby causing the electronic ID access control computer to authenticate the identity information; receiving, by the mobile device, an electronic ID authentication response message from the electronic ID access control computer, the electronic ID authentication response message PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 indicating that the electronic identification is authentic; and in response to receiving the electronic ID authentication response message, transmitting, by the mobile device, to a server computer, a registration request message indicating that the electronic identification is authentic, the registration request message including at least one of a token associated with the mobile device and a mobile device identifier associated with the mobile device, thereby causing the server computer to store a record indicating that at least one of the token and the mobile device identifier is electronic ID verified. [0005] Another embodiment is related to a mobile device comprising: processor; and a computer readable medium, the computer readable medium comprising code executable by the processor to cause the processor to perform operations including: receiving a communication comprising identity information from an electronic identification; transmitting an electronic ID authentication request message including the identity information to an electronic ID access control computer, thereby causing the electronic ID access control computer to authenticate the identity information; receiving an electronic ID authentication response message from the electronic ID access control computer, the electronic ID authentication response message indicating that the electronic identification is authentic; and in response to receiving the electronic ID authentication response message, transmitting, to a server computer, a registration request message indicating that the electronic identification is authentic, the registration request message including at least one of a token associated with the mobile device and a mobile device identifier associated with the mobile device, thereby causing the server computer to store a record indicating that at least one of the token and the mobile device identifier is electronic ID verified. [0006] Another embodiment is related to a system comprising: a mobile device including: a first processor; and a first computer readable medium, the first computer readable medium comprising first code executable by the first processor to cause the first processor to perform first operations including: receiving a communication comprising identity information from an electronic identification; transmitting an electronic ID authentication request message including the identity information to an electronic ID access control computer; receiving an electronic ID PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 authentication response message from the electronic ID access control computer, the electronic ID authentication response message indicating that the electronic identification is authentic; and in response to receiving the electronic ID authentication response message, transmitting, to a server computer, a registration request message indicating that the electronic identification is authentic, the registration request message including at least one of a token associated with the mobile device and a mobile device identifier associated with the mobile device; the server computer including: a second processor; and a second computer readable medium, the second computer readable medium comprising second code executable by the second processor to cause the second processor to perform second operations including: receiving the registration request message from the mobile device; and storing a record indicating that at least one of the token and the mobile device identifier is electronic ID verified; and the electronic ID access control computer including: a third processor; and a third computer readable medium, the third computer readable medium comprising third code executable by the third processor to cause the third processor to perform third operations including: receiving the electronic ID authentication request message from the mobile device; authenticating the identity information; and transmitting the electronic ID authentication response message to the mobile device. [0007] Another embodiment is related to a method comprising receiving, by the processing computer an authorization request message comprising a token; communicating, by the processing computer, with at least one server computer to obtain credentials associated with the token; communicating, by the processing computer, with the at least one server computer to determine that the token is electronic ID verified; determining, by the processing computer, a risk score based on the token being electronic ID verified; modifying, by the processing computer, the authorization request message to include the risk score; and transmitting, by the processing computer, the authorization request message to an authorizing entity computer. [0008] A better understanding of the nature and advantages of embodiments of the invention may be gained with reference to the following detailed description and accompanying drawings. PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 BRIEF DESCRIPTION OF THE DRAWINGS [0009] FIG.1 shows a block diagram of a system and a process flow diagram, according to an embodiment. [0010] FIG.2 illustrates a diagram of an exemplary mobile device according to an embodiment. [0011] FIG.3 shows a block diagram of an exemplary identification service computer according to an embodiment. [0012] FIG.4 shows a block diagram of an exemplary biometric validation computer according to an embodiment. [0013] FIG.5 shows a block diagram of an exemplary processing computer according to an embodiment. DETAILED DESCRIPTION [0014] Prior to discussing embodiments of the invention, some terms can be described in further detail. [0015] A “user” may include an individual or a computing device. In some embodiments, a user may be associated with one or more personal accounts and/or mobile devices. In some embodiments, the user may be a cardholder, account holder, or consumer. [0016] A “computing device” may be any suitable electronic device that can process and communicate information to other electronic devices. The computing device may include a processor and a computer readable medium coupled to the processor, the computer readable medium comprising code, executable by the processor. The computing device may also each include an external communication interface for communicating with each other and other entities. Examples of computing devices may include user devices, access devices, mobile devices, auxiliary devices, server computers, resource provider computers, processing network computers, authorizing entity computers, transport computers, token provider computers, and the like. PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 [0017] A “user device” may be any suitable device operated by a user. User devices may be in any suitable form. Some examples of user devices include cellular phones, smartphones, mobile phones, payment cards, smartcards, PDAs, personal computers (PCs), tablet computers, and the like. In some embodiments, where a user device is a mobile device, the mobile device may include a display, a memory, a processor, a computer-readable medium, and any other suitable component. [0018] A “mobile device” may comprise any suitable electronic device that may be transported and operated by a user, which may also provide remote communication capabilities to a network. A mobile device such as a mobile communication device may communicate using a mobile phone (wireless) network, wireless data network (e.g., 3G, 4G or similar networks), Wi-Fi, Bluetooth, Bluetooth Low Energy (BLE), Wi-Max, or any other communication medium that may provide access to a network such as the Internet or a private network. Examples of mobile devices include mobile phones (e.g., cellular phones), PDAs, tablet computers, net books, laptop computers, wearable devices (e.g., a watch, earpiece, rings, bracelets, glasses), vehicles such as automobiles and motorcycles, personal music players, hand-held specialized readers, etc. A mobile device may comprise any suitable hardware and software for performing such functions, and may also include multiple devices or components (e.g., when a device has remote access to a network by tethering to another device - i.e., using the other device as a modem – both devices taken together may be considered a single mobile device). The mobile device may include one or more processors capable of processing user input. The mobile device may also include one or more input sensors for receiving user input. There are a variety of input sensors capable of detecting user input, such as accelerometers, cameras, microphones, etc. The user input obtained by the input sensors may be from a variety of data input types, including, but not limited to, audio data, visual data, or biometric data. [0019] A “mobile device identifier” may comprise any suitable information that serves to identify a mobile device. Examples of a mobile device identifier include a MSISDN, a phone number, an SMS text address, an IP address, or any other information that may be used to identify a mobile device. In some embodiments, a device identifier can include a unique device number, such as an international mobile PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 station equipment identity (IMEI) number, a unique serial number (i.e., integrated circuit card identifier (ICCI)) of a subscriber identification module (SIM) card, or a unique international mobile subscriber identity (IMSI). [0020] An “electronic identification,” also referred to as “electronic ID” or an “eID,” may be a digital proof of identity. An electronic ID can serve as an identification tool for individuals or organizations. An electronic ID can be a physical item usable for both online and offline personal identification or authentication. An electronic ID can include identity information that can be used to authenticate the identity of the electronic ID’s owner. The identity information can be visually displayed and/or digitally encoded on the electronic ID. For example, an electronic ID can include printed or embossed identity information such as an identification number (e.g., a passport number, license number, or badge number), name, address, age, date of birth, place of birth, weight, eye color, nationality, ethnicity, expiration date, issue date, a photograph, and/or and other suitable printed personal details. The identification number is also referred to as a serial number. The electronic ID can also include a contact element, a contactless element (e.g., RFID microchip) or any other suitable processor, memory, and/or antenna. The memory may contain digital versions of some or all of the printed identity information, a digital certificate, one or more encryption keys, and/or one or more biometric templates (e.g., fingerprint templates, facial recognition templates, iris templates, etc.) or other data for biometric verification. Accordingly, an electronic ID can include both a printed copy and a digital copy of identity information. Examples of electronic IDs include an electronic passport (“ePassport”) and electronic identification card (e.g., e-Driving license, smart card). An electronic ID may be issued by a government authority. [0021] “Electronic ID verification” may be a verification of association with an electronic ID. A device or information that is verified to be associated with an electronic ID may be “electronic ID verified.” For example, a device can be given a status of electronic ID verified when an electronic ID interacts with the device and/or when the electronic ID is authenticated through messages send from the device to an electronic ID authenticating server. Information, such as a token, that is uniquely stored at the device or otherwise uniquely associated with the device can also PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 become electronic ID verified when the device is electronic ID verified. Electronic ID verification can serve as evidence that an individual identified by the electronic ID is in possession of the device, has ownership of the device, and/or is otherwise associated with the device. The state of being electronic ID verified is also referred to as being identity verified, identity authenticated, identity bound, mobile device verified, mobile device authenticated, mobile device bound, a “something you have” verification, and/or a first identity verification. [0022] An “electronic ID authentication request message” may be an electronic message for requesting authentication of an electronic ID. In some embodiments, it is sent to an electronic ID access control computer to request authentication of the electronic ID. An electronic ID authentication request message may comprise identity information provided by an electronic ID, such as an identification number (e.g., license number, passport number) and/or user data (e.g., name, age, address, date of birth). An electronic ID authentication request message may also include biometric verification data, a cryptogram and/or a digital signature generated by the electronic ID, and/or any other suitable information digitally encoded on the electronic ID. The cryptogram and/or the digital signature may be generated using dynamic input data such as a counter, timestamp, and/or challenge value (e.g., a nonce), which also may be included in the message. Some or all of the data included in the electronic ID authentication request message can be encrypted using an electronic ID access control computer public key, an electronic ID private key, and/or a session key. The electronic ID authentication request message may also include a certificate and/or public key associated with the electronic ID. In some embodiments, the electronic ID authentication request message may be generated by a computing device at which the electronic ID is being presented. The electronic ID authentication request message may also include information provided by the computing device, such as a location, a time, biometric data collected from a user at the time when the electronic ID is presented, and/or any other information that may be utilized in determining whether to authenticate an electronic ID. Additionally, in some embodiments, the electronic ID authentication request message may include information for verifying the authenticity PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 of the computing device, such as a digital signature generated by the computing device and/or a certificate issued to the computing device. [0023] One form of eID is an electronic identification card (eIC), which is a physical identity card that can be used for online and offline personal identification or authentication. The eIC is a smart card in ID-1 format of a regular bank card, with identity information printed on the surface (such as personal details and a photograph) and in an embedded RFID microchip, similar to that in biometric passports. The chip stores the information printed on the card (such as the holder's name and date of birth) and the holder's photo(s). Several photos may be taken from different angles along with different facial expressions, thus allowing the biometric facial recognition systems to measure and analyze the overall structure, shape and proportions of the face.[1] It may also store the holder's fingerprints. The card may be used for online authentication, such as for age verification or for e-government applications. An electronic signature, provided by a private entity (e.g., government entity or private company), may also be stored on the chip. [0023] An “electronic ID authentication response message” may be reply to an electronic ID authentication request message. In some embodiments, an electronic ID authentication response message may be an electronic message generated by an electronic ID access control computer to reply to an electronic ID authentication request message. The electronic ID authentication response message may include information indicating whether an electronic ID is authentic, such as a confirmation data element. In some embodiments, the electronic ID authentication response message may include some or all of the information included in the electronic ID authentication request message. Some or all of the data included in the electronic ID authentication response message can be encrypted using an electronic ID access control computer private key, a computing device public key, and/or a session key. [0024] A “confirmation data element” may be a data element indicating a successful authentication or verification. For example, a confirmation data element may indicate successful authentication of the electronic ID. A confirmation data element, which is also referred to as a “fingerprint,” may serve as proof of PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 authentication. In some embodiments, the confirmation data element can be a hash value generated based on at least some of the other data elements included in an electronic ID authentication response message, an electronic ID authentication request message, or associated with the electronic ID. For example, a confirmation data element can be a hash value generated based on the identification number of the electronic ID, the certificate of the electronic ID, and/or any other suitable electronic ID data. In some embodiments, the confirmation data element can be a digital signature generated based on a private key associated with the electronic ID access control computer, the hash value, and/or some of the other data elements (e.g., a timestamp, an identification number) included in the electronic ID authentication response message or the electronic ID authentication request message. In some embodiments, the confirmation data element is a static value. [0025] “Biometric verification” may be a verification of association with a biometric template or other pre-established biometric data. A device or information that is verified to be associated with a biometric template may be “biometric verified.” For example, a device can be given a status of biometric verified when a biometric input is received at the device and then verified to match a biometric template. Information, such as a token, that is uniquely stored at the device or otherwise uniquely associated with the device can also become biometric verified when the device is biometric verified. Biometric verification can serve as evidence that an individual identified by a biometric template (e.g., as stored by an electronic ID) is in possession of the device, has ownership of the device, and/or is otherwise associated with the device. The state of being biometric verified is also referred to as being biometric authenticated, biometric bound, a “something you are” verification, and/or a second identity verification. [0026] An “interaction” may include a reciprocal action or influence. An interaction can include a communication, contact, or exchange between parties, devices, and/or entities. Example interactions include a transaction between two parties and a data exchange between two devices. In some embodiments, an interaction can include an identity interaction in which two devices interact to authenticate an identity. In some embodiments, an interaction can include a payment transaction in which two devices can interact to facilitate a payment. PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 [0027] “Interaction data” can include data related to and/or recorded during an interaction. In some embodiments, interaction data can be transaction data or network data. Transaction data can comprise a plurality of data elements with data values. [0028] “Credentials” may comprise any evidence of authority, rights, or entitlement to privileges. For example, access credentials may comprise permissions to access certain tangible or intangible assets, such as a building or a file. Examples of credentials may include passwords, account numbers, passcodes, or secret messages. [0029] “Payment credentials” may include any suitable information associated with an account (e.g., a payment account and/or payment device associated with the account). Such information may be directly related to the account or may be derived from information related to the account. Examples of account information may include a PAN (primary account number or “account number”), username, expiration date, CVV (card verification value), dCVV (dynamic card verification value), CVV2 (card verification value 2), CVC3 card verification values, etc. CVV2 is generally understood to be a static verification value associated with a payment device. CVV2 values are generally visible to a user (e.g., a consumer), whereas CVV and dCVV values are typically embedded in memory or authorization request messages and are not readily known to the user (although they are known to the issuer and payment processors). Payment credentials may be any information that identifies or is associated with a payment account. Payment credentials may be provided to make a payment from a payment account. Payment credentials can also include a username, an expiration date, a gift card number or code, and any other suitable information. [0030] A “token” may be a substitute value for a credential. A token may be a string of numbers, letters, or any other suitable characters. Examples of tokens include payment tokens, access tokens, personal identification tokens, etc. [0031] A “payment token” may include an identifier for a payment account that is a substitute for an account identifier, such as a primary account number (PAN). For example, a payment token may include a series of alphanumeric characters that PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 may be used as a substitute for an original account identifier. For example, a token “4900000000000001” may be used in place of a PAN “4147090000001234.” In some embodiments, a payment token may be “format preserving” and may have a numeric format that conforms to the account identifiers used in existing transaction processing networks (e.g., ISO 8583 financial transaction message format). In some embodiments, a payment token may be used in place of a PAN to initiate, authorize, settle or resolve a payment transaction or represent the original credential in other systems where the original credential would typically be provided. In some embodiments, a payment token may be generated such that the recovery of the original PAN or other account identifier from the token value may not be computationally derived. Further, in some embodiments, the token format may be configured to allow the entity receiving the token to identify it as a token and recognize the entity that issued the token. [0032] “Tokenization” is a process by which data is replaced with substitute data. For example, a payment account identifier (e.g., a primary account number (PAN)) may be tokenized by replacing the primary account identifier with a substitute number (e.g., a token) that may be associated with the payment account identifier. Further, tokenization may be applied to any other information that may be replaced with a substitute value (i.e., token). Tokenization enhances transaction efficiency and security. [0033] A “token issuer,” token provider,” “token service system,” or “token service computer” can include a system that services tokens. In some embodiments, a token service system can facilitate requesting, determining (e.g., generating) and/or issuing tokens, as well as maintaining an established mapping of tokens to primary account numbers (PANs) in a repository (e.g., token vault). In some embodiments, the token service system may establish a token assurance level for a given token to indicate the confidence level of the token to PAN binding. The token service system may include or be in communication with a token vault where the generated tokens are stored. The token service system may support token processing of payment transactions submitted using tokens by de-tokenizing the tokens to obtain the actual PANs. In some embodiments, a token service system may include a tokenization computer alone, or in combination with other computers PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 such as a transaction processing network computer. Various entities of a tokenization ecosystem may assume the roles of the token service provider. For example, payment networks and issuers or their agents may become the token service provider by implementing the token services according to embodiments of the present invention. [0034] A “token domain” may indicate an area and/or circumstance in which a token can be used. Examples of token domains may include, but are not limited to, payment channels (e.g., e-commerce, physical point of sale, etc.), POS entry modes (e.g., contactless, magnetic stripe, etc.), and merchant identifiers to uniquely identify where the token can be used. A set of parameters (i.e., token domain restriction controls) may be established as part of token issuance by the token service provider that may allow for enforcing appropriate usage of the token in payment transactions. For example, the token domain restriction controls may restrict the use of the token with particular presentment modes, such as contactless or e-commerce presentment modes. In some embodiments, the token domain restriction controls may restrict the use of the token at a particular merchant that can be uniquely identified. Some exemplary token domain restriction controls may require the verification of the presence of a token cryptogram that is unique to a given transaction. In some embodiments, a token domain can be associated with a token requestor. [0035] A “token cryptogram” may include a token authentication verification value (TAVV) associated with a token. A token cryptogram may be a string of numbers, letters, or any other suitable characters, of any suitable length. In some embodiments, a token cryptogram may include encrypted token data associated with a token (e.g., a token domain, a token expiry date, etc.). For example, a token cryptogram may be used to validate that the token is being used within a token domain and/or by a token expiry date associated with the token. [0036] “Token data” can include information related to a token. Token data can include a token and/or a token cryptogram. In some embodiments, token data can include only a token. In other embodiments, token data can include only a token cryptogram. In yet other embodiments, token data can include a token and a token PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 cryptogram that is related to the token. Token data can include additional data related to the token (e.g., a token expiry date, etc.). [0037] A “token expiry date” can include an expiration date/time of the token. The token expiry date may be passed among the entities of the tokenization ecosystem during transaction processing to ensure interoperability. The token expiration date may be a numeric value (e.g., a 4-digit numeric value). In some embodiments, the token expiry date can be expressed as a time duration as measured from the time of issuance. [0038] A “token request message” may be an electronic message for requesting token data. A token request message can request token data including a token and/or a token cryptogram. A token request message may include information usable for identifying an identity account or identity record, a payment account or digital wallet, and/or information for generating a payment token. For example, a token request message may include payment credentials, a mobile device identification information (e.g., a phone number or MSISDN), a digital wallet identifier, information identifying a tokenization service provider, a merchant identifier, a token cryptogram, information related to an electronic ID or authentication of an electronic ID, and/or any other suitable information. Information included in a token request message can be encrypted (e.g., with an issuer-specific key). [0039] A “token response message” may be a message that responds to a token request. A token response message may include an indication that a token request was approved or denied. A token response message may also include a payment token, mobile device identification information (e.g., a phone number or MSISDN), a digital wallet identifier, information identifying a tokenization service provider, a merchant identifier, a token cryptogram, and/or any other suitable information. Information included in a token response message can be encrypted (e.g., with an issuer-specific key). [0040] A “token requestor identifier” may include any characters, numerals, or other identifiers associated with an entity associated with a network token system. For example, a token requestor identifier may be associated with an entity that is PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 registered with the network token system. In some embodiments, a unique token requestor identifier may be assigned for each domain for a token request associated with the same token requestor. For example, a token requestor identifier can identify a pairing of a token requestor (e.g., a mobile device, a mobile wallet provider, etc.) with a token domain (e.g., e-commerce, contactless, etc.). A token requestor identifier may include any format or type of information. For example, in one embodiment, the token requestor identifier may include a numerical value such as a ten digit or an eleven-digit number (e.g., 4678012345). [0041] An “amount” can include a quantity of something. An amount can include a total of a thing or things in number, size, value, or extent. [0042] A “resource provider” may be an entity that can provide a resource such as goods, services, information, and/or access. Examples of resource providers includes merchants, data providers, transit agencies, governmental entities, venue and dwelling operators, etc. [0043] The term "authentication" and its derivatives may include a process by which the credential of an endpoint (including but not limited to applications, people, devices, processes, and systems) can be verified to ensure that the endpoint is who they are declared to be. [0044] The term "verification" and its derivatives may include a process that utilizes information to determine whether an underlying subject is valid under a given set of circumstances. Verification may include any comparison of information to ensure some data or information is correct, valid, accurate, legitimate, and/or in good standing. [0045] A “key” may include a piece of information that is used in a cryptographic algorithm to transform input data into another representation. A cryptographic algorithm can be an encryption algorithm that transforms original data into an alternate representation, or a decryption algorithm that transforms encrypted information back to the original data. Examples of cryptographic algorithms may include triple data encryption standard (TDES), data encryption standard (DES), advanced encryption standard (AES), etc. PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 [0046] A "public key" may include an encryption key that may be shared openly and publicly. The public key may be designed to be shared and may be configured such that any information encrypted with the public key may only be decrypted using a private key associated with the public key (i.e., a public/private key pair). [0047] A "private key" may include any encryption key that may be protected and secure. A private key may be securely stored at an entity and may be used to decrypt any information that has been encrypted with an associated public key of a public/private key pair associated with the private key. [0048] A “public/private key pair” may refer to a pair of linked cryptographic keys generated by an entity. The public key may be used for public functions such as encrypting a message to send to the entity or for verifying a digital signature which was supposedly made by the entity. The private key, on the other hand may be used for private functions such as decrypting a received message or applying a digital signature. In some embodiments, the public key may be authorized by a body known as a Certification Authority (CA) which stores the public key in a database and distributes it to any other entity which requests it. The private key can typically be kept in a secure storage medium and will usually only be known to the entity. Public and private keys may be in any suitable format, including those based on Rivest- Shamir-Adleman (RSA) or elliptic curve cryptography (ECC). [0049] A "digital signature" may include a type of electronic signature. A digital signature may encrypt documents with digital codes that can be difficult to duplicate. In some embodiments, a digital signature may refer to the result of applying an algorithm based on a public/private key pair, which allows a signing party to manifest, and a verifying party to verify, the authenticity and integrity of a document. The signing party acts by means of the private key and the verifying party acts by means of the public key. This process certifies the authenticity of the sender, the integrity of the signed document and the so-called principle of nonrepudiation, which does not allow disowning what has been signed. A certificate or other data that includes a digital signature by a signing party is said to be "signed" by the signing party. PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 [0050] A "certificate" or "digital certificate" may include an electronic document and/or data file. In some cases, the certificate or the digital certificate may be a device certificate. In some embodiments, a digital certificate may use a digital signature to bind a public key with data associated with an identity. A digital certificate may be used to prove the ownership of a public key. The certificate may include one or more data fields, such as the legal name of the identity, a serial number of the certificate, a valid-from and valid-to date for the certificate, certificate related permissions, etc. A certificate may contain a "valid-from" date indicating the first date the certificate is valid, and a "valid-to" date indicating the last date the certificate is valid. A certificate may also contain a hash of the data in the certificate including the data fields. A certificate can be signed by a certificate authority. The certificate or digital certificate can also include interaction data such as one or more access device identifiers, one or more user device identifiers (e.g., VIN numbers), a timestamp of when the certificate was created, a validity period, an authentication computer public key, etc. [0051] A "certificate authority" may include an entity that issues digital certificates. A certificate authority may prove its identity using a certificate authority certificate, which includes the certificate authority’s public key. A certificate authority certificate may be signed by another certificate authority’s private key or may be signed by the same certificate authority’s private key. The latter is known as a self- signed certificate. The certificate authority may maintain a database of all certificates issued by the certificate authority. The certificate authority may maintain a list of revoked certificates. The certificate authority may be operated by an entity, for example, a processing network entity, an issuer, an acquirer, a central bank etc. In some cases, a certificate authority can maintain an authentication computer. [0052] An “authorization request message” may be an electronic message that requests authorization for a transaction. In some embodiments, it is sent to a payment processing network and/or an issuer of a payment account to request authorization for a payment transaction. An authorization request message according to some embodiments may comply with ISO 8583, which is a standard for systems that exchange electronic transaction information associated with a payment made by a consumer using a payment device or a payment account. An PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 authorization request message may also comprise additional data elements corresponding to “identification information” including, for example, a service code, a CVV (card verification value), a dCVV (dynamic card verification value), an expiration date, etc. An authorization request message may also comprise “transaction data,” such as any information associated with a current transaction (e.g., the transaction amount, merchant identifier, merchant location, etc.), as well as any other information that may be utilized in determining whether to identify and/or authorize a payment transaction. [0053] An “authorization response message” may be reply to an authorization request message. In some embodiments, an authorization response message may be an electronic message reply to an authorization request message generated by an issuing financial institution (i.e., issuer) or a payment processing network. An authorization response message according to some embodiments may comply with ISO 8583, which is a standard for systems that exchange electronic transaction information associated with a payment made by a consumer using a payment device or a payment account. The authorization response message may include an authorization code, which may be a code that an account issuing bank returns in response to an authorization request message in an electronic message (either directly or through the payment processing network) to a merchant's access device (e.g., point of sale terminal) that indicates approval of the transaction. The code may serve as proof of authorization. As noted above, in some embodiments, a payment processing network may generate and/or forward the authorization response message to the merchant. [0054] An “authorization computer” may include any system involved in authorization of a transaction. The authorization computer may determine whether a transaction can be authorized and may generate an authorization response message including an authorization status (also may be known as an authorization decision). In some embodiments, an authorization computer may be a payment account issuer computer. In some cases, the authorization computer may store contact information of one or more users. In other embodiments, the authorization computer may authorize non-financial transactions involving a user. For example, the authorization computer may make an authorization decision regarding whether the user can PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 access a certain resource. In some cases, the authorization computer may be a content provider server computer associated with a content providing entity, which manages one or more resources that may be accessed by the user. The authorization computer may be known as an authorizing entity computer. The authorization computer may include an “access control server” that may be configured to authenticate a user. [0055] A “network processing computer” or a “processing computer” may include a server computer used for interaction processing. In some embodiments, the network processing computer may be coupled to a database and may include any hardware, software, other logic, or combination of the preceding for servicing the requests from one or more client computers or user devices. The network processing computer may comprise one or more computational apparatuses and may use any of a variety of computing structures, arrangements, and compilations for servicing the requests from one or more client computers or user devices. In some embodiments, the network processing computer may operate multiple server computers. In such embodiments, each server computer may be configured to process an interaction for a given region or handles transactions of a specific type based on interaction data. [0056] The network processing computer may include data processing subsystems, networks, and operations used to support and deliver authorization services, exception file services, and clearing and settlement services. An exemplary network processing computer may include VisaNet™. Networks that include VisaNet™ are able to process credit card transactions, debit card transactions, and other types of commercial transactions. VisaNet™, in particular, includes an integrated payments system (Integrated Payments system) which processes authorization requests and a Base II system, which performs clearing and settlement services. The network processing computer may use any suitable wired or wireless network including the Internet. [0057] The network processing computer may process transaction-related messages (e.g., authorization request messages and authorization response messages) and determine the appropriate destination computer (e.g., issuer PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 computer/authorizing entity computer) for the interaction-related messages. In some embodiments, the network processing computer may authorize interactions on behalf of an issuer. The network processing computer may also handle and/or facilitate the clearing and settlement of financial transactions. [0058] An “access device” may be any suitable device that provides access to a resource. An access device may be in any suitable form. Some examples of access devices include an energy supply terminal (e.g., an electric charger at a charging station), gasoline pumps, vending machines, kiosks, POS or point of sale devices (e.g., POS terminals), cellular phones, PDAs, personal computers (PCs), tablet PCs, hand-held specialized readers, set-top boxes, electronic cash registers (ECRs), automated teller machines (ATMs), virtual cash registers (VCRs), and the like. An access device may use any suitable contact or contactless mode of operation to send or receive data from, or associated with, a user mobile communication device. In some embodiments, an access device may include a reader, a processor, and a computer-readable medium. A reader may include any suitable contact or contactless mode of operation. For example, exemplary readers can include radio frequency (RF) antennas, optical scanners, bar code readers, or magnetic stripe readers to interact with a payment device and/or mobile communication device. [0059] A “processor” may include a device that processes something. In some embodiments, a processor can include any suitable data computation device or devices. A processor may comprise one or more microprocessors working together to accomplish a desired function. The processor may include a CPU comprising at least one high-speed data processor adequate to execute program components for executing user and/or system-generated requests. The CPU may be a microprocessor such as AMD's Athlon, Duron and/or Opteron; IBM and/or Motorola's PowerPC; IBM's and Sony's Cell processor; Intel's Celeron, Itanium, Pentium, Xeon, and/or XScale; and/or the like processor(s). [0060] A “memory” may be any suitable device or devices that can store electronic data. A suitable memory may comprise a non-transitory computer readable medium that stores instructions that can be executed by a processor to PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 implement a desired method. Examples of memories may comprise one or more memory chips, disk drives, etc. Such memories may operate using any suitable electrical, optical, and/or magnetic mode of operation. [0061] A “server computer” may include a powerful computer or cluster of computers. For example, the server computer can be a large mainframe, a minicomputer cluster, or a group of servers functioning as a unit. In one example, the server computer may be a database server coupled to a Web server. The server computer may comprise one or more computational apparatuses and may use any of a variety of computing structures, arrangements, and compilations for servicing the requests from one or more client computers. [0062] Embodiments of the invention provide a system and method for verifying that a mobile device and/or mobile device token linked to a user’s transaction account is truly owned by, operated by, or otherwise associated with that user. For example, the user can present a physical electronic ID and/or provide a biometric to the mobile device. The electronic ID can be authenticated (e.g., through communications with an electronic ID access control computer), and/or the biometric can be authenticated (e.g., through comparison with a biometric template locally or at a server). As these are physical items that a user is in possession of or is present to provide, they provide additional evidence that the account holder is the person operating the mobile device. With this verification, subsequent mobile device transactions (e.g., using a token installed on the mobile device) can be highly trusted as being authentically conducted by the accountholder and not an attempted breach of data security or account security. [0063] FIG.1 shows a block diagram of a system 100, according to embodiments. The system 100 comprises an account card 101, an electronic ID 102, a mobile device 103, an eID access control computer 110, a token service computer 120, an identification service computer 130, a biometric validation computer 140, a resource provider computer 150, a transport computer 160, a processing computer 170, and an authorizing entity computer 180. [0064] The electronic ID 102 and the account card 101 can be in operative communication with the mobile device 103. The mobile device 103 can be in PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 operative communication with the eID access control computer 110 and the resource provider computer 150. Each of the mobile device 103, the token service computer 120, the identification service computer 130, and the biometric validation computer 140 can be in operative communication with one another. The resource provider computer 150 can be in operative communication with the transport computer 160. The transport computer 160 can be in operative communication with the network processing computer 170. The network processing computer can be in operative communication with the authorizing entity computer 180 and the token service computer 120. [0065] For simplicity of illustration, a certain number of components are shown in FIG.1. It is understood, however, that embodiments of the invention may include more than one of each component. In addition, some embodiments of the invention may include fewer than or greater than all of the components shown in FIG.1. [0066] Messages between the devices in the system 100 in FIG.1 can be transmitted using a secure communications protocols such as, but not limited to Secure Hypertext Transfer Protocol (HTTPS), SSL, ISO (e.g., ISO 8583) and/or the like. The communications network include any one and/or the combination of the following: a direct interconnection; the Internet; a Local Area Network (LAN); a Metropolitan Area Network (MAN); an Operating Missions as Nodes on the Internet (OMNI); a secured custom connection; a Wide Area Network (WAN); a wireless network (e.g., employing protocols such as, but not limited to a Wireless Application Protocol (WAP), I-mode, and/or the like); and/or the like. The communications network can use any suitable communications protocol to generate one or more secure communication channels. A communications channel may, in some instances, comprise a secure communication channel, which may be established in any known manner, such as through the use of mutual authentication and a session key, and establishment of a Secure Socket Layer (SSL) session. [0067] The account card 101 can include a card (e.g., a plastic or metal substrate), or any other suitable physical object. The account card 101 can include account information associated with an account. For example, the account card 101 can be a payment device that includes payment credentials associated with a PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 payment account. According to embodiments, the account card 101 can take the form of any suitable type of payment device. [0068] Payment credentials can be included in visible form and/or digital encoded form. For example, visible payment credentials can be printed, embossed, or otherwise visually displayed on the account card 101. Digitally encoded payment credentials can be stored on one or more memory chips of the account card 101. [0069] A contact element, a contactless element (e.g., an RFID chip) and/or a magnetic stripe for interfacing with a computing device may be present on, or embedded within, a substrate or page of the account card 101. The account card 101 may comprise any other suitable attached or embedded microprocessors, antennas, and/or memory chips with user data stored in them. [0070] The account card 101 can be configured for interacting with a computing device. For example, the user can present the account card 101 to the mobile device 103 to add the payment account associated with the account card 101 to a payment application of the mobile device 103. Upon being inserted, tapped, or otherwise brought near to or into physical contact with the mobile device 103, the electronic ID 102 can communicate with the mobile device 103 to provide the payment credentials. For example, the account card 101 can communicate with the mobile device 103 through physical contacts, or through contactless short-range communications (e.g., NFC, RF, Bluetooth, etc.). [0071] The electronic ID 102 can include a card (e.g., a plastic or metal substrate), a booklet, or any other suitable physical object. The electronic ID 102 can include identity information that can be used to authenticate the identity of a user to which the electronic ID is assigned. For example, the electronic ID 102 can be a physical item with identity information that is visually displayed and/or digitally encoded information for both online and offline identification of individuals or organizations. Examples of an electronic ID include an electronic passport (“ePassport”) and an electronic identification card (e.g., e-Driving license, smart card). [0072] Visible identity information can be printed, embossed, or otherwise visually displayed on the electronic ID 102. The identity information can be related to PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 the user’s identity and/or a user identity account. For example, the identity information can include an identification number (e.g., a passport number, license number, or badge number), name, address, age, date of birth, place of birth, weight, eye color, nationality, ethnicity, expiration date, issue date, a photograph, and/or and other suitable personal details. An identification number can also be referred to as a serial number. [0073] Digitally encoded information can include any suitable data. For example, digitally encoded information can include digital versions of identity information, which can include digital copies of some or all the visible identity information. One or more memory chips of the electronic ID 102 may contain the digitally encoded information. Additionally, the one or more memory chips can contain a digital certificate, one or more encryption keys, a dynamic chip identifier (e.g., that changes for each interaction and/or message), one or more biometric templates (e.g., fingerprint templates, facial recognition templates, etc.), one or more biometric images, and/or or other data for biometric verification. Biometric verification files can be formatted to comply with the specifications in the International Civil Aviation Organization's (ICAO) Doc 9303. [0074] A contact element, a contactless element (e.g., an RFID chip) and/or a magnetic stripe for interfacing with a computing device may be present on, or embedded within, a substrate or page of the electronic ID 102. The electronic ID 102 may comprise any other suitable attached or embedded microprocessors, antennas, and/or memory chips with user data stored in them. [0075] The electronic ID 102 can be configured for interacting with a computing device. For example, the user can present the electronic ID 102 to the mobile device 103 to conduct an identity interaction. Upon being inserted, tapped, or otherwise brought near to or into physical contact with the mobile device 103, the electronic ID 102 can communicate with the mobile device 103 to conduct an interaction. For example, the electronic ID 102 can communicate with the mobile device 103 through physical contacts, or through contactless short-range communications (e.g., NFC, RF, Bluetooth, etc.). PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 [0076] In some embodiments, the electronic ID 102 can take the form of one or more software modules and/or secure hardware elements (which can be referred to as a digital identification) installed on a computing device, such as the mobile device 103. [0077] In some embodiments, the electronic ID 102 may not include payment credentials or otherwise be configured for payment transactions. Instead, the electronic ID 102 can be configured solely for identity interactions and identity authentication. [0078] The electronic ID 102 may be configured to interact only with certain authorized devices. For example, the electronic ID 102 can authenticate the mobile device 103 (e.g., a software module thereof) to ensure that the mobile device 103 is configured to receive and process identity information, and to communicate according to certain predefined security protocols (which are discussed in more detail below). [0079] The mobile device 103 may comprise any suitable electronic device that may be transported and operated by a user, which may also provide remote communication capabilities to a network. The mobile device 103 may be suitable device for interacting with an electronic ID 102 and or account card 101, and/or for communicating with one or more server computers, such as the resource provider computer 150, the token service computer 120, the identification service computer 130, the biometric validation computer 140, and/or the eID access control computer 110. [0080] The mobile device 103 may use any suitable contact or contactless mode of operation to send or receive data from an electronic ID 102. For example, the mobile device 103 can include a near-field communications (NFC) reader. [0081] FIG.2 illustrates a diagram of a mobile device 103 according to an embodiment. The mobile device 103 may include device hardware 105 coupled to a system memory 104. [0082] Device hardware 105 may include a processor 105A, a short range antenna 105E, a long range antenna 105F, input elements 105C, a user interface PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 105B, and output elements 105D (which may be part of the user interface 105B). Examples of input elements may include microphones, keypads, touchscreens, sensors, etc. Input elements can one or more biometric readers (e.g., cameras, fingerprint sensors, etc.). Examples of output elements may include speakers, display screens, and tactile devices. The processor 105A can be implemented as one or more integrated circuits (e.g., one or more single core or multicore microprocessors and/or microcontrollers), and is used to control the operation of mobile device 103. The processor 105A can execute a variety of programs in response to program code or computer-readable code stored in the system memory 104, and can maintain multiple concurrently executing programs or processes. [0083] The long range antenna 105F may include one or more RF transceivers and/or connectors that can be used by the mobile device 103 to communicate with other devices and/or to connect with external networks. The long range antenna 105F may be configured to communicate with a remote base station and a remote cellular or data network, over the air. The short range antenna 105E may be configured to communicate with external entities through a short range communication medium. The short range antenna 105E may comprise a contactless interface that can interact with a contactless interface of another device (e.g., a portable device). Examples of a contactless interface may include one or more radio frequency (RF) transceivers that can send and receive communications using near- field communications (NFC), or other radio frequency or wireless communication protocols. The user interface 105B can include any combination of input and output elements to allow a user to interact with and invoke the functionalities of the mobile device 103. [0084] The system memory 104 can be implemented using any combination of any number of non-volatile memories (e.g., flash memory) and volatile memories (e.g., DRAM, SRAM), or any other non-transitory storage medium, or a combination thereof media. The system memory 104 may store computer code, executable by the processor 105A, for performing any of the functions described herein. For example, the system memory 104 may comprise a computer readable medium comprising code, executable by the processor 105A, for implementing a method comprising: receiving, by a mobile device, a communication comprising identity PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 information from an electronic identification; transmitting, by the mobile device, an electronic ID authentication request message including the identity information to an electronic ID access control computer, thereby causing the electronic ID access control computer to authenticate the identity information; receiving, by the mobile device, an electronic ID authentication response message from the electronic ID access control computer, the electronic ID authentication response message indicating that the electronic identification is authentic; and in response to receiving the electronic ID authentication response message, transmitting, by the mobile device, to a server computer, a registration request message indicating that the electronic identification is authentic, the registration request message including at least one of a token associated with the mobile device and a mobile device identifier associated with the mobile device, thereby causing the server computer to store a record indicating that at least one of the token and the mobile device identifier is electronic ID verified. [0085] The system memory 104 may also store an interaction application 104A, an electronic ID control module 104B, registration module 104C, a token module 104D, a biometric module 104E, and an operating system 104F. [0086] The interaction application 104A may include instructions or code executable by the processor 105A for initiating and conducting an interaction such as those described above. For example, an in-person interaction can be conducted by transmitting a token to a nearby device through short-range contactless communications, and an internet interaction can be conducted by transmitting a token to a server computer over-the-air through long-range communications. [0087] The electronic ID control module 104B may include instructions or code executable by the processor 105A for authenticating an electronic ID. This can include communications with the electronic ID 102 to receive identity information, communications with the eID access control computer 110 to authenticate the electronic ID 102, and/or verifying response message information received from the eID access control computer 110. [0088] The registration module 104C may include instructions or code executable by the processor 105A for registering the mobile device and/or PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 associated elements (e.g., token or digital wallet) as electronic ID verified. This can include communications with one or more server computers, such as the identification service computer 130. [0089] The token module 104D may include instructions or code executable by the processor 105A for obtaining a token associated with an account. This can include communications with one or more server computers, such as the token service computer 120. The token module 104D may also store one or more tokens, cryptographic keys, and/or user data. [0090] The biometric module 104E may include instructions or code executable by the processor 105A for registering the mobile device and/or associated elements (e.g., token or digital wallet) as biometric verified. This can include communications with one or more server computers, such as the biometric validation computer 140. [0091] Referring back to FIG.1, the eID access control computer 110 can be any suitable device configured to authenticate identities and/or electronic IDs. The eID access control computer 110 can include a server computer operated by an identity authenticating entity, which may be an entity that authenticates an identity. An example of an authenticating entity may be a government entity, business entity, or other authority that provides and/or manages identification documents for individuals. The eID access control computer 110 may include data processing subsystems, networks, and operations used to support and deliver identity authentication services. For example, the eID access control computer 110 may comprise a server coupled to a network interface (e.g., by an external communication interface), and databases of information. The eID access control computer 110 may use any suitable wired or wireless network, including the Internet. [0092] The eID access control computer 110 can store any suitable information about one or more users, electronic identifications, and/or identity accounts. The eID access control computer 110 can be configured to authenticate identity information received in an eID authentication request message by comparing with identity information stored in a database. The eID access control computer 110 PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 may also be configured to verify the authenticity of requesting electronic IDs and/or mobile devices (e.g., by verifying corresponding digital signatures). [0093] In some embodiments, the eID access control computer 110 may function as a Single Point of Contact (SPOC) that is configured to verify electronic IDs for a specific region or group. Additionally, the eID access control computer 110 be a Document Verifying Certification Authority that issues certificates and/or keys to the mobile device 103 and/or the electronic ID 102. In some embodiments, the eID access control computer 110 can distribute software (e.g., in the form of an electronic identification control module) to the mobile device 103 for participating in an identity authentication network. [0094] The token service computer 120 can include a computer programmed to facilitate requesting, determining (e.g., generating) and/or issuing token data, as well as maintaining an established mapping of token data to credentials (e.g., primary account numbers), user data (e.g., a name, address, etc.), and/or any other suitable account information in a repository (e.g., token vault). The token service computer 120 may include or be in communication with a token vault where the generated tokens are stored. The token service computer 120 may support token processing of interactions submitted using tokens by de-tokenizing the tokens to obtain the actual credentials. In some embodiments, a token service computer 120 may include a tokenization computer alone, or in combination with other computers such as a network processing computer 170. [0095] FIG.3 shows a block diagram of an identification service computer 130. The identification service computer 130 may include a processor 131 and a computer readable medium 134, a data storage 133 which can store one or more records 133A, and a network interface 132 coupled to the processor 131. [0096] The computer readable medium 134 may comprise a communication module 135 and a verification module 136. [0097] The communication module 135 can comprise code, executable by the processor 131 to cause the processor 131 to communicate with external entities such as the mobile device 103, the processing computer 170, the token service computer 120, and/or the biometric validation computer 140. PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 [0098] The verification module 136 may comprise code that causes the processor 131 to verify that a mobile device and/or associated elements (e.g., a token, a digital wallet) are associated with an authenticated electronic ID 102, and/or that the electronic ID 102 and an account are both associated with the same user identity, as described in more detail below. Information about electronic ID verified mobile devices, associated elements, and/or account information can be stored in the records 133A. [0099] FIG.4 shows a block diagram of a biometric validation computer 140. The biometric validation computer 140 may include a processor 141 and a computer readable medium 144, a data storage 143 which can store one or more records 143A, and a network interface 142 coupled to the processor 141. [0100] The computer readable medium 144 may comprise a communication module 145 and a verification module 146. [0101] The communication module 145 can comprise code, executable by the processor 141 to cause the processor 141 to communicate with external entities such as the mobile device 103, the processing computer 170, the token service computer 120, and/or the identification service computer 130. [0102] The verification module 146 may comprise code that causes the processor 141 to verify that a mobile device and/or associated elements (e.g., a token, a digital wallet) are associated with an authenticated biometric, and/or that a user account and an electronic ID 102 from which a biometric template was obtained are both associated with the same user identity, as described in more detail below. Information about biometric verified mobile devices, associated elements, and/or account information can be stored in the records 143A. [0103] Referring back to FIG.1, processing computer 170 may be disposed between the transport computer 160 and the authorizing entity computer 180. The processing computer 170 may include data processing subsystems, networks, and operations used to support and deliver authorization services, exception file services, and clearing and settlement services. For example, the processing computer 170 may comprise a server coupled to a network interface (e.g., by an external communication interface), and databases of information. The processing computer PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 170 may be representative of a transaction processing network. An exemplary transaction processing network may include VisaNet™. Transaction processing networks such as VisaNet™ are able to process credit card transactions, debit card transactions, and other types of commercial transactions. VisaNet™, in particular, includes a VIP system (Visa Integrated Payments system) which processes authorization requests and a Base II system which performs clearing and settlement services. The processing computer 170 may use any suitable wired or wireless network, including the Internet. [0104] FIG.5 shows a block diagram of a processing computer 170. The processing computer 170 may include a processor 171 and a computer readable medium 174, a data storage 173, and a network interface 172 coupled to the processor 171. [0105] The computer readable medium 174 may comprise a communication module 175, a token module 176, and a risk analysis module 177. [0106] The communication module 175 can comprise code, executable by the processor 171 to cause the processor 171 to communicate with external entities such as the mobile device 103, the transport computer 160, the authorizing entity computer 180, the token service computer 120, the biometric validation computer 140, and/or the identification service computer 130. [0107] The token module 176 may comprise code that causes the processor 171 to obtain credentials associated with a token from a token service computer 120. [0108] The risk analysis module 177 may comprise code that causes the processor 171 to determine a risk score for an interaction. This can include determining whether a token, mobile device, and/or digital wallet associated with the interaction is electronic ID verified and/or biometric verified. [0109] The computer readable medium 174 may comprise code executable by the processor 171 for performing operations comprising: receiving, by the processing computer an authorization request message comprising a token; communicating, by the processing computer, with at least one server computer to obtain credentials associated with the token; communicating, by the processing computer, with the at PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 least one server computer to determine that the token is electronic ID verified; determining, by the processing computer, a risk score based on the token being electronic ID verified; modifying, by the processing computer, the authorization request message to include the risk score; and transmitting, by the processing computer, the authorization request message to an authorizing entity computer. [0110] Referring back to FIG.1, in some embodiments, one or more server computers can be combined. For example, one or more of the token service computer 120, the biometric validation computer 140, the identification service computer 130, and/or the processing computer 170 may be combined into one or more consolidate server computers. Each computer and the respective functionality described above may be embodied as one or more modules in such a combined server computer. For example, the records discussed above with respect to accounts, tokens, mobile devices, electronic ID verifications, biometric verifications, etc., can be combined into a master record. [0111] The resource provider computer 150 can include any suitable computational apparatus operated by a resource provider (e.g., a merchant). In some embodiments, the resource provider computer 150 may be configured to send data to a network processing computer 170 via a transport computer 160 as part of a payment verification and/or authentication process for a transaction between the user (e.g., consumer) and the resource provider. The resource provider computer 150 may also be configured to generate authorization request messages for transactions between the resource provider and the user, and route the authorization request messages to an authorizing entity computer 180 for transaction processing. In some embodiments, the resource provider computer 150 may include one or more server computers that may host one or more websites associated with the resource provider (e.g., a merchant). [0112] In some embodiments, a resource provider can utilize an access device in addition to and/or instead of the resource provider computer 150. For example, an access device can be configured to communicate with the mobile device 103 for in-person transactions. The access device can provide information received from the mobile device 103 to the resource provider computer 150. An PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 access device may use any suitable contact or contactless mode of operation to send or receive data from a mobile device 103. Some examples of access devices include POS devices, cellular phones, PDAs, personal computers (PCs), tablet PCs, hand-held specialized readers, set-top boxes, electronic cash registers (ECRs), automated teller machines (ATMs), virtual cash registers (VCRs), kiosks, security systems, access systems, Websites, and the like. In some embodiments, the mobile device 103 can communicate directly with the resource provider computer 150 without interacting with the access device for internet-based transactions. [0113] The transport computer 160 can include a server computer. The transport computer 160 may be associated with an acquirer, which may be an entity (e.g., a commercial bank) that has a business relationship with a particular merchant or other entity. Some entities can perform both issuer and acquirer functions. Some embodiments may encompass such single entity issuer-acquirers. [0114] The authorizing entity computer 180 can include a server computer operated by an authorizing entity. An authorizing entity may be an entity that authorizes a request. An example of an authorizing entity may be an issuer, which may typically refer to a business entity (e.g., a bank) that maintains an account for a user. An issuer may also issue and manage an account associated with a user device. [0115] The processing computer 170, the transport computer 160, and the authorizing entity computer 180 may operate suitable routing tables to route authorization request messages and/or authorization response messages using credentials, token data, merchant identifiers, and/or other account identifiers. [0116] A method according to embodiments of the invention can also be described with respect to FIG.1. The steps shown in the method may be performed sequentially or in any suitable order in embodiments of the invention. In some embodiments, one or more of the steps may be optional. [0117] A user may wish to utilize a mobile device 103 for transactions. To initiate the method, the mobile device 103 may receive a user input for opening a payment application (e.g., a digital wallet or a merchant application) and/or adding a payment card to the payment application. PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 [0118] At step 1A, the user may tap or otherwise present an account card 101 at the mobile device 103 in order to add the account card 101 to the payment application of the mobile device 103. The account card 101 can transmit payment credentials to the mobile device 103. Alternatively, the user can manually enter account card 101 information at the mobile device 103. [0119] At step 1B, the mobile device 103 can communicate with the token service computer 120 to obtain a payment token associated with payment credentials of the account card 101. For example, the mobile device 103 can generate and send a token request message to the token service computer 120. The token request message can include the payment credentials, a cryptogram, a mobile device identifier, a digital wallet identifier, and/or any other suitable information. [0120] At step 1C, the token service computer 120 can generate or otherwise obtain a payment token for the payment credentials and/or an associated payment account. The token service computer 120 may store a record indicating that the payment token is associated with the payment credentials and/or payment account. The record can additionally indicate that the payment token is associated with the mobile device 103 (e.g., as identified by the mobile device identifier or digital wallet identifier) in response to receiving the token request message from the mobile device 103. In some embodiments, the payment token can be a unique value issued for usage by the mobile device 103. [0121] At step 1D, the token service computer 120 can transmit the payment token to the mobile device 103. For example, the token service computer 120 can generate and send a token response message to the mobile device 103. The token response message can include the payment token, a token cryptogram, the associated mobile device identifier and/or digital wallet identifier, and/or any other suitable information for processing a payment transaction (e.g., a security code, an expiration date, a name, an address, a phone number). [0122] In addition to activating payment functionality of the mobile device, the user may wish to provide verification that the user is the account holder of the account associated the account card 101. In some embodiments, the mobile device PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 103 may prompt the user to provide identity verification, which can increase security and trust in transactions conducted through the mobile device 103. In some embodiments, transaction functionality at the mobile device 103 may be disabled until identity verification is complete, thereby preventing malicious actors from violating secure data by adding another user’s payment card to their mobile device. [0123] To initiate identity verification, the user can select an identity verification option at the mobile device 103 (e.g., within a digital wallet application). The user can then present an electronic ID 102 to the mobile device 103. For example, the user can tap or insert the electronic ID 102 at or near a reader of the mobile device 103 to initiate communications (e.g., NFC communications) between the electronic ID 102 and the mobile device 103. [0124] At step 2, the electronic ID 102 can provide identity information to the mobile device 103 for an identity interaction. For example, the electronic ID 102 can provide an identification number (e.g., license number, passport number), user data (e.g., name, age, address, date of birth), and/or any other suitable information encoded on the electronic ID 102. The electronic ID 102 may also provide a cryptogram and/or a digital signature, which may be generated for this interaction, and which may be generated using dynamic input data such as a counter, challenge value (e.g., a nonce) received from the mobile device 103, and/or a timestamp. [0125] Additionally, in some embodiments, the electronic ID 102 can provide biometric information to the mobile device 103. For example, the electronic ID 102 can provide a biometric template to the mobile device 103. [0126] In some embodiments, some or all of the identity information and/or biometric information can be provided to the mobile device 103 in an encrypted form (e.g., encrypted with an electronic ID private key). Accordingly, the mobile device 103 may not have access to sensitive unencrypted identity information and/or biometric information. [0127] In some embodiments, the identity information and/or biometric information can be provided to the mobile device 103 for the identity interaction through a series of one or more communications according to any suitable communication protocol, such as ISO/IEC 7816. For example, the one or more PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 communications can include Application Protocol Data Unit (ADPU) messages. The one or more communications can include communications to establish a secure communication channel, communications for the electronic ID 102 and the mobile device 103 to verify the authenticity of the other device (e.g., mutual authentication), and/or exchanging of any suitable information between the electronic ID 102 and the mobile device 103. In some embodiments, the electronic ID 102 and the mobile device 103 can mutually authenticate using corresponding private keys and/or certificates issued by the eID access control computer 110 (e.g., or any other suitable certificate authority). Communications between the electronic ID 102 and the mobile device 103 can be encrypted and otherwise protected through any suitable secure communication protocol, such as Basic Access Control (BAC), Passive Authentication (PA), Active Authentication (AA), Extended Access Control (EAC) which can authenticate the reader and encrypt the electronic ID data, and Supplemental Access Control (SAC). [0128] In some embodiments, the electronic ID 102 can initially provide an application identifier that identifies an application for processing electronic IDs. In response to such an application identifier, the mobile device 103 may determine to utilize an electronic identification control module to process communications with the electronic ID 102. [0129] At step 3, the mobile device 103 can (e.g., via the electronic identification control module) can communicate with the eID access control computer 110 to verify that the identity information received from the electronic ID 102 is authentic. For example, the mobile device 103 can generate and transmit an eID authentication request message to the eID access control computer 110. The eID authentication request message can comprise the identity information, a cryptogram and/or digital signature, dynamic data elements (e.g., a timestamp, challenge value, or counter), and/or any other suitable information received from the electronic ID 102. Some or all of the data included in the eID authentication request message can be encrypted. [0130] At step 4, the eID access control computer 110 can authenticate the identity information and/or electronic ID. The eID access control computer 110 can PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 verify whether the electronic ID is authentic based on the received eID authentication request message and any other suitable data known to the eID access control computer 110. For example, the eID access control computer 110 can decrypt information included in the eID authentication request message such as encrypted identity information (e.g., using on a private key associated with the eID access control computer 110, or a session key established between the eID access control computer 110 and the electronic ID 102). The eID access control computer 110 can check a database to verify that the identification number is valid, confirm that any other user data included in the eID authentication request message matches database records, validate a cryptogram from the electronic ID 102, and/or verify a digital signature generated the electronic ID 102. Further, the eID access control computer 110 can use public key infrastructure to verify a certificate associated with the electronic ID 102, which may be included in the eID authentication request message. For example, the eID access control computer 110 can verify a digital signature provided by a certificate authority and included in the certificate. [0131] In some embodiments, the eID access control computer 110 can also perform one or more communications to mutually authenticate with the mobile device 103 (e.g., via an electronic identification control module of the mobile device 103). For example, mutual authentication can be performed by exchanging and verifying digital signatures based on corresponding private keys and certificates, which may be issued by the eID access control computer 110 or any other suitable certificate authority. [0132] At step 5, the eID access control computer 110 can generate and transmit an eID authentication response message to the mobile device 103. The eID authentication response message can indicate that the identity information is authentic, the electronic ID 102 is authentic, and/or that the user is authorized to access restricted information or services based on the authentic electronic ID. The eID authentication response message can further include some or all of the identity information, a timestamp, a random value, a digital signature, and/or any other suitable information, some or all of which may be encrypted. PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 [0133] In some embodiments, the eID access control computer 110 can retrieve or generate a confirmation data element. The eID authentication response message can include the confirmation data element. The confirmation data element may be a data element that indicates successful authentication of the electronic ID. In some embodiments, the confirmation data element can be a hash value generated based on some or all of the information included in the eID authentication response message or associated with the electronic ID 102. For example, the confirmation data element can be a hash value generated based on the identification number of the electronic ID 102, the certificate of the electronic ID 102, and/or any other suitable electronic ID data. Additionally, or alternatively, the confirmation data element can include a digital signature generated based on a private key associated with the eID access control computer 110, the hash value, and/or some or all of the information included in the eID authentication response message (e.g., a timestamp, an identification number). In some embodiments, the confirmation data element is a static value. The confirmation data element is also referred to as a “fingerprint.” [0134] The mobile device 103 can analyze the eID authentication response message to verify that the eID access control computer 110 authenticated the electronic ID. For example, the mobile device 103 (e.g., via the electronic identification control module) can verify the confirmation data element (e.g., the hash value and/or digital signature) using a public key associated with the eID access control computer 110. In some embodiments, the mobile device 103 can verify a digital signature included in the eID authentication response message. [0135] In some embodiments, the mobile device 103 can determine whether the identity information corresponds to user information associated with the payment token and/or digital wallet. For example, the mobile device 103 can compare a first name from the identity information with a second name associated with the payment account (e.g., account card 101, payment token, or digital wallet). If the names match, the mobile device 103 can determine that the electronic ID 102 and the payment account are both associated with the same user. In other words, the mobile device 103 can verify that a first identity (e.g., associated with a token and/or digital wallet) is the same as a second identity (e.g., associated with an electronic ID). The mobile device 103 can execute the comparison at any suitable time, such PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 as after receiving the identity information from the electronic ID 102 in step 2, and/or after receiving the eID authentication response message from the eID access control computer 110 in step 5. [0136] After authentication of the electronic ID, the electronic identification control module at the mobile device 103 can proceed to register the token and/or mobile device 103 as electronic ID verified by providing information about the identity interaction and successful authentication to one or more server computers. For example, at step 6, the mobile device 103 can generate and transmit a registration request message to a server computer. While the identification service computer 130 will be used as an example, the registration request message can be transmitted to the token service computer 120, the processing computer 170, and/or any suitable server computer. [0137] The registration request message can include any suitable information for linking the authenticated identity with the token, the mobile device 103, and/or the digital wallet. For example, the registration request message can include the payment token and/or other account information associated with the payment account. In some embodiments, the registration request message can include information identifying a plurality of tokens and/or a plurality of accounts associated with the mobile device 103. The registration request message can include the mobile device identifier, a digital wallet, and/or any other suitable mobile device information. The registration request message can include some or all of the identity information from the electronic ID 102 and/or information from the eID authentication request message, such as a name and/or identification number. The registration request message can include information indicating that the electronic ID was verified by the eID access control computer 110. For example, the confirmation data element and/or a digital signature generated by the eID access control computer 110. [0138] In some embodiments, sensitive identification information, such as the identification number, may not be provided to the identification service computer 130. The identification service computer 130 may instead use encrypted or obscured PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 information related to the electronic ID 102, such as the confirmation data element, to confirm that the electronic ID 102 has been authenticated. [0139] At step 7, the identification service computer 130 can process the registration request message to determine that the mobile device and/or token are electronic ID verified. For example, the identification service computer 130 can validate the registration request message to verify that the eID access control computer 110 authenticated the electronic ID. For example, the identification service computer 130 can verify the confirmation data element (e.g., the hash value) using, for example, a public key associated with the eID access control computer 110. [0140] As another example, the identification service computer 130 can verify a digital signature included in the registration request message using a public key associated with the eID access control computer 110. The public key associated with the eID access control computer 110 can be included (e.g., in the form of a digital certificate issued by a certificate authority) in the registration request message or retrieved from a public database. Additionally, the identification service computer 130 can check a timestamp included in the registration request message to verify that the eID access control computer 110 validated the electronic ID recently, within a predetermined time threshold (e.g., 10 seconds, 30 seconds, 1 minute, 5 minutes, 10 minutes, 1 hour, 1 day, etc.). [0141] In some embodiments, the identification service computer 130 can determine whether the identity information corresponds to account information associated with the payment token, mobile device 103, and/or digital wallet. For example, the identification service computer 130 can identify an account associated with the payment token, mobile device identifier, and/or digital wallet indicated in the registration request message. The identification service computer 130 can identify the account via a local database lookup or by querying the token service computer 120. The identification service computer 130 can retrieve user data associated with the identified account, and then compare the user data with corresponding user data associated with the electronic ID 102. For example, the identification service computer 130 can compare a name from the identity information of the electronic ID 102 with a name associated with the identified account of the payment token, mobile PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 device identifier, and/or digital wallet. If the names match, the identification service computer 130 can determine that the electronic ID 102 and the account are both associated with the same user. Other user data can be compared additionally or alternatively, such as a user address, age, nationality, etc. In other words, the identification service computer 130 can verify that a first identity (e.g., associated with a token and/or digital wallet) such as a first name, matches a second identity (e.g., associated with an electronic ID) such as a second name based on any suitable user data. [0142] If the registration request message is validated and/or user data matched, as discussed above, the identification service computer 130 may determine that the mobile device 103 and/or token are verified to be associated with the electronic ID 102. In other words, the identification service computer 130 can determine that the person in physical possession of the mobile device 103 is also in physical possession of the electronic ID 102 of the account holder. As a result, the identification service computer 130 can confirm with confidence that the mobile device 103 is in the physical possession of the account holder, and therefore the account holder intended to activate payment functionality for the account at the mobile device 103 and request the payment token, and that these actions were not taken by a malicious actor. For example, it is unlikely that a malicious actor inappropriately obtained the user’s payment card and presented it to the malicious actor’s mobile device 103, as the malicious actor likely would not also have possession of the user’s electronic ID 102. [0143] In response, the identification service computer 130 may mark one or more items (e.g., the mobile device identifier, the token, the digital wallet, and/or any other items or information associated with the mobile device 103 at which the electronic ID 102 was physically presented) as electronic ID verified to be legitimately owned and operated by the payment account holder. For example, the identification service computer 130 can store a record indicating that the mobile device 103 (e.g., as identified by the mobile device identifier or other device fingerprint), one or more tokens associated with the mobile device 103 (e.g., tokens uniquely provisioned to the mobile device 103 and not used by other computing devices), and/or a digital wallet associated with the mobile device are electronic ID PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 verified. As a result, when any of these items are used in a transaction, there can be high confidence that the transaction is not an account breach or other data compromise. The record can also include user data, the confirmation element, and/or any other suitable information. [0144] In some embodiments, instead of creating a new record the identification service computer 130 can update one or more existing records associated with the mobile device 103, digital wallet, and/or one or more tokens to indicate that these items are electronic ID verified to be associated with the accountholder of one or more corresponding payment accounts. This can include adding the confirmation data element and/or any other suitable information to the existing records. Additionally, the identification service computer 130 can communicate with one or more other servers, such as the token service computer 120, about the electronic ID verification. The token service computer 120 (and any other suitable servers) can then also update their records to indicate that mobile device 103 (e.g., as identified by a mobile device identifier), digital wallet, and/or one or more tokens to indicate that these items are electronic ID verified. [0145] At step 8, the identification service computer 130 can generate and transmit a registration response message to the mobile device 103. The registration response message can indicate that one or more tokens (e.g., one token or a plurality of tokens), the mobile device 103, and/or the digital wallet have been successfully electronic ID verified. [0146] In some embodiments, in addition to authenticating the electronic ID 102 with user data corresponding to the account holder, user biometrics can also be authenticated. Biometric verification can provide an additional level of confidence that the operator of the mobile device 103 is the accountholder. [0147] At step 9, the mobile device 103 can prompt the user to provide biometric input (e.g., a fingerprint scan, facial images such as a selfie photo, iris scan) for a biometric verification process. The mobile device 103 can receive biometric input from the user, and then execute a comparison between the biometric input and a biometric template to verify whether the user-input biometric data matches the biometric template within a predetermined threshold. If there is a PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 match, the mobile device 103 is biometrically verified to be in the possession of the user that is biometrically identified by the electronic ID 102. [0148] The biometric template may be pre-established biometric data associated with the user, and the biometric template can be obtained from any suitable source (e.g., a server computer). In some embodiments, the biometric template can be received from the electronic ID 102 (e.g., during step 2). [0149] According to embodiments, the mobile device 103 can perform the biometric verification using software included in by an eID access control module or in a separate biometric authentication module. [0150] After the biometric verification, the mobile device 103 can proceed to register the token and/or mobile device 103 as biometric verified by providing information about the successful biometric verification to one or more server computers. For example, at step 10, the mobile device 103 can generate and transmit a biometric validation message to a server computer. While the biometric validation computer 140 will be used as an example, the biometric validation message can be transmitted to the token service computer 120, the processing computer 170, the identification service computer 130, and/or any suitable server computer. [0151] The biometric validation message can indicate that biometrics received from a user in possession of the mobile device 103 were successfully verified by matching with a biometric template from the electronic ID 102. The biometric validation message can include any suitable information for linking the verified biometric with the tokens, the mobile device 103, and/or the digital wallet. For example, the biometric validation message can include the payment token and/or other account information associated with the payment account. In some embodiments, the biometric validation message can include information identifying multiple tokens and/or accounts associated with the mobile device 103. The biometric validation message can include the mobile device identifier, a digital wallet, and/or any other suitable mobile device information. In some embodiments, the biometric validation message can include the biometric input received from the user, PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 the biometric template, data representing the result of the biometric comparison or verification process, and/or any other suitable information. [0152] At step 11, the biometric validation computer 140 can process the biometric validation message to determine that the mobile device 103 and/or token are biometric verified. For example, in response to receiving a biometric validation message indicating that biometric verification was successful, the biometric validation computer 140 may determine that the mobile device 103 and/or token are verified to be associated with the account holder. In other words, the biometric validation computer 140 can determine that the person in physical possession of the mobile device 103 has the unique biometric attributes indicated by a biometric template of the electronic ID 102 of the account holder. As a result, the biometric validation computer 140 can confirm with further confidence that the mobile device 103 is in the physical possession of the account holder, and therefore the account holder intended to activate payment functionality for the account at the mobile device 103 and request the payment token, and that these actions were not taken by a malicious actor. For example, it is unlikely that a malicious actor inappropriately obtained the user’s payment card and electronic ID 102 and presented both to the malicious actor’s mobile device 103, as the malicious actor would not be able to provide the necessary biometric input for biometric verification. Thus, data and account security can remain intact. [0153] In response, the biometric validation computer 140 may mark one or more items (e.g., the mobile device identifier, the token, the digital wallet, and/or any other items or information associated with the mobile device 103 at which the biometrics were scanned) as biometric verified to be legitimately owned and operated by the payment account holder. For example, the biometric validation computer 140 can store a record indicating that the mobile device 103 (e.g., as identified by the mobile device identifier or other device fingerprint), one or more tokens associated with the mobile device 103 (e.g., tokens uniquely provisioned to the mobile device 103 and not used by other computing devices), and/or a digital wallet associated with the mobile device are biometric verified. As a result, when any of these items are used in a transaction, there can be even higher confidence that the transaction is not a breach of data security or account security. The record PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 can also include the biometric input, biometric template, and/or any other suitable information. [0154] In some embodiments, instead of creating a new record the biometric validation computer 140 can update one or more existing records associated with the mobile device 103, digital wallet, and/or tokens to indicate that these items are biometric verified to be associated with the accountholder of one or more corresponding payment accounts. This can include adding a biometric verification result and/or any other suitable information to the existing records. Additionally, the biometric validation computer 140 can communicate with one or more other servers, such as the token service computer 120 and/or identification service computer 130, about the biometric verification. The token service computer 120 (and any other suitable servers) can then also update their records to indicate that mobile device 103 (e.g., as identified by a mobile device identifier), digital wallet, and/or tokens to indicate that these items are biometric verified. [0155] At step 12, the biometric validation computer 140 can generate and transmit a biometric response message to the mobile device 103. The biometric response message can indicate that the token, the mobile device 103, and/or the digital wallet have been successfully biometric verified. [0156] At a later time, when the mobile device 103 is used for a transaction, the transaction can be considered low-risk or otherwise secure based on the mobile device having been previously electronic ID verified and/or biometric verified. [0157] For example, the user may wish to purchase a good or service from resource provider. The user can operate the mobile device 103 to initiate a transaction with the resource provider. For example, the user can activate a contactless payment mode on the mobile device 103 for an in-person transaction and present the mobile device 103 to an access device of the resource provider to initiate short-range contactless communications. For an internet-based transaction, the user can select one or more items for purchase through a web or shopping application of the resource provider accessed via the mobile device 103 and execute a checkout and payment process. PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 [0158] At step 13, the mobile device 103 can transmit payment information to the resource provider computer 150. For example, the mobile device 103 can provide a payment token, a cryptogram, a mobile device identifier, a digital wallet identifier, and/or any other suitable information for the transaction to the resource provider computer 150. For an in-person transaction, the mobile device 103 can provide the information to the access device (e.g., via shortrange communications), and the access device can then forward the information to the resource provider computer 150. For an internet-based transaction, the mobile device 103 can provide the information to the resource provider computer 150 through wireless internet communications. [0159] At step 14, the resource provider computer 150 (and/or the access device) can generate an authorization request message for the payment transaction. The authorization request message can include the payment token, cryptogram, mobile device identifier, a digital wallet identifier, a value (e.g., transaction amount), other transaction information (e.g., items purchased), merchant information (e.g., merchant name, location, etc.), and any other suitable information. [0160] The resource provider computer 150 can then transmit the authorization request message to the processing computer 170, which can process the transaction using the using the token and/or any other suitable account information. In some embodiments, transmitting the authorization request message to the processing computer 170 can take place through several iterative transmissions. For example, as a part of step 14, the resource provider computer 150 transmit the authorization request message to the transport computer 160. At step 15, the transport computer 160 may forward the authorization request message to the processing computer 170. [0161] The processing computer 170 may then perform one or more actions to process the transaction. For example, at step 16, the processing computer 170 may generate a credential request message that requests the payment credential that is associated with the payment token. The credential request message can include the payment token, a token cryptogram, the mobile device identifier, and/or any other suitable information received in the authorization request message. The processing PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 computer 170 can transmit the credential request message to the token service computer 120. [0162] At step 17, the token service computer 120 can identify a payment credential associated with the payment token. For example, the token service computer 120 can look up an account associated with the payment token and retrieve a set of stored payment credentials associated with the account. The token service computer 120 may also verify that the payment token is valid, for example by checking an expiration time and/or validating a cryptogram. The token service computer 120 can send a response including the payment credentials to the processing computer 170 (e.g., in a credential response message). [0163] At step 18, the processing computer 170 can communicate with the identification service computer 130 to determine whether the transaction is associated with an electronic ID verification. The processing computer 170 can provide the token, mobile device identifier, digital wallet identifier, and/or any other suitable information. [0164] At step 19, the identification service computer 130 can identify a corresponding record or account, and analyze the record to determine whether one or more electronic ID verifications exist. For example, the identification service computer 130 can determine whether the mobile device 103 (e.g., as indicated by the mobile device identifier), the token, and/or the digital wallet identifier are electronic ID verified. The identification service computer 130 can send a response to the processing computer 170 indicating that the transaction is associated with an electronic ID verification. The response can indicate what device and/or value has been electronic ID verified (e.g., the mobile device identifier, the token, and/or the digital wallet identifier). [0165] At step 20, the processing computer 170 can communicate with the biometric validation computer 140 to determine whether the transaction is associated with a biometric verification. The processing computer 170 can provide the token, mobile device identifier, digital wallet identifier, and/or any other suitable information. [0166] At step 21, the biometric validation computer 140 can identify a corresponding record or account, and analyze the record to determine whether one PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 or more biometric verifications exist. For example, the biometric validation computer 140 can determine whether the mobile device 103 (e.g., as indicated by the mobile device identifier), the token, and/or the digital wallet identifier are biometric verified. The biometric validation computer 140 can send a response to the processing computer 170 indicating that the transaction is associated with a biometric verification. The response can indicate what device and/or value has been biometric verified (e.g., the mobile device identifier, the token, and/or the digital wallet identifier). [0167] At step 22, the processing computer 170 may determine a risk score for the transaction. The processing computer 170 may determine a risk score based on any suitable transaction information and considerations. For example, the processing computer 170 may determine a risk score based on whether the token, digital wallet, and/or mobile device 103 have been electronic ID verified and/or biometric verified. Electronic ID verification and/or biometric verification can cause the risk score to indicate that risk is unlikely (e.g., a lower risk score). In some embodiments, the presence of electronic ID verification and/or biometric verification can indicate that unauthorized account use and/or account compromise is unlikely (e.g., a near-zero risk score). The processing computer 170 can lower the risk score based on each of the electronic ID verification and the biometric verification individually. In some embodiments, when the electronic ID verification and the biometric verification are both present together, the processing computer lowers the risk score further. Other factors that may affect a risk score include transaction amount, location, merchant identity, past account behavior, and/or any other suitable information. [0168] At step 23, the processing computer 170 can update the authorization request message to include the payment credentials and the risk score. In some embodiments, the processing computer 170 can update the authorization request message to also include an indication that the transaction is associated with an electronic ID verification (e.g., in an assurance indicator data field), an indication that the transaction is associated with a biometric verification (e.g., in an assurance indicator data field), and/or any other suitable information. The processing computer 170 may also remove the payment token from the authorization request message. PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 The processing computer 170 may then forward the modified authorization request message to the authorizing entity computer 180. [0169] At step 24, the authorizing entity computer 180 may authorize or reject the transaction. The authorizing entity computer 180 may determine whether to authorize the transaction based on the payment token and/or payment credentials, the risk score, an indication that the transaction is associated with an electronic ID verification, an indication that the transaction is associated with a biometric verification, and/or any other suitable information. For example, the authorizing entity computer 180 may identify the payment account identified by the payment credentials and/or payment token, and may determine whether there are sufficient funds. The authorizing entity computer 180 may analyze a risk score, determine a second risk score, and/or otherwise evaluate the likelihood of an account breach or data compromise. In some embodiments, a low-risk score (e.g., as lowered by electronic ID verification and/or biometric verification) below a threshold risk score value can cause the authorizing entity computer 180 to authorize the transaction. In some embodiments, an indication of an electronic ID verification and/or an indication of a biometric verification can cause the authorizing entity computer 180 to authorize the transaction. The authorizing entity computer 180 may then generate and send to the processing computer 170 an authorization response message indicating whether or not the transaction was authorized. The authorization response message may include the payment credentials, payment token, transaction details, merchant information, and/or any other suitable information. [0170] At step 25, the processing computer 170 may forward the authorization response message to the transport computer 160. In some embodiments, before forwarding, the processing computer 170 may first modify the authorization response message to add the payment token and/or remove the payment credentials. This may involve additional communications with the token service computer 120 to obtain the payment token associated with the payment credentials. [0171] At step 26, the transport computer 160 may forward the authorization response message to the resource provider computer 150. PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 [0172] At step 27, the resource provider computer 150 may determine that the transaction was successfully authorized based on the authorization response message. The resource provider computer 150 may then allow the purchased goods and/or services to be released to the user. Further, the resource provider computer 150 may store a transaction record including the payment token, user information, transaction details, mobile device identifier, and/or any other suitable information. In some embodiments, the resource provider computer 150 may forward the authorization response message to an access device and/or the access device may allow the purchased goods and/or services to be released to the user. Additionally, in some embodiments, the resource provider computer 150 (or an access device) may forward the authorization response message and/or a transaction receipt to the mobile device 103. [0173] At the end of the day, a normal clearing and settlement process can be conducted by the processing computer 170. A clearing process is a process of exchanging financial details between an acquirer and an authorizing entity to facilitate posting to a user's payment account and reconciliation of the user's settlement position. [0174] Embodiments include a number of alternatives, additions, and modifications to the method steps described above. For example, the method above describes communications between the electronic ID 102 and the mobile device 103 with respect to step 2, and then communications between the mobile device 103 and eID access control computer 110 with respect to steps 3-5. In other embodiments, steps 2-5 can be combined and/or modified in any suitable manner. For example, the eID access control computer 110 may support the mobile device 103 during communications with the electronic ID 102, and/or the electronic ID 102 may exchange messages with the eID access control computer 110 through the mobile device 103 to authenticate the electronic ID. For example, the electronic ID 102 and the eID access control computer 110 can verify the authenticity of one another (e.g., mutual authentication). In some embodiments, the electronic ID 102 and the eID access control computer 110 can mutually authenticate using corresponding private keys and certificates. Communications between the electronic ID 102 and the eID access control computer 110 can be encrypted and otherwise protected through any PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 suitable secure communication protocol, such as Basic Access Control (BAC), Passive Authentication (PA), Active Authentication (AA), Extended Access Control (EAC), and Supplemental Access Control (SAC). [0175] In some embodiments, the token request message as described with respect to step 1B, the registration request message as described with respect to step 6, and/or the biometric validation message as described with respect to step 10 can be combined. For example, the mobile device 103 can send a single registration message to the token service computer 120 including some or all of the information described above with respect to step 1B, step 6, and/or step 10. The token service computer 120 can then provide a token as discussed with respect to steps 1C-1D, and can forward any suitable information and/or records to the identification service computer 130 and/or biometric validation computer 140, which can register electronic ID verification as described above with respect to steps 7-8 and biometric verification as described above with respect to steps 11-12. [0176] As discussed above with respect to step 9, biometrics may be verified by the mobile device 103. Additionally or alternatively, embodiments also allow the mobile device 103 to transmit the biometric inputs to the eID access control computer 110 to be verified as a part of the electronic ID authentication. In other embodiments, the eID access control computer 110 can receive confirmation from the mobile device 103 that the biometric input was verified at the mobile device 103. Further, the eID access control computer 110 may be configured to provide a biometric verification result as a part of the eID authentication response message. [0177] Embodiments allow step 9 to take place at any suitable time. For example, the mobile device 103 can prompt the user and receive the biometric input at the same time as or immediately after the user presents the electronic ID 102 to the mobile device 103. Additionally, the comparison with the biometric template to verify the biometric input can be performed before, at the same time as, or after any of steps 3-8. [0178] In some embodiments, in addition to or instead of relying on a biometric verification that may be performed by the mobile device 103 at step 9, the biometric validation computer 140 may perform a biometric verification as a part of PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 step 11. For example, the biometric validation computer 140 can receive from the mobile device 103 the user biometric input and the biometric template. The biometric validation computer 140 can then execute a comparison of the biometric input and the biometric template to verify whether the user-input biometric data matches the biometric template within a predetermined threshold. If there is a match, the biometric validation computer 140 can determine that the mobile device 103 is biometrically verified to be in the possession of a user that is biometrically identified by the electronic ID 102. As discussed above, the user identified by the electronic ID 102 may be confirmed to be the accountholder as a part of one or more of steps 2-7. [0179] As discussed above, a payment token may be provisioned to the mobile device 103 through steps 1A-1D. In some embodiments, steps 1A-1D can occur after performing electronic ID verification and/or biometric verification in steps 2-12. For example, one or more of steps 2-12 can be executed to electronic ID verify and/or biometric verify the mobile device 103 (e.g., the mobile device identifier) and/or the digital wallet before the token is provisioned. Then, steps 1A-1D can be executed to provision the token. In some embodiments, the token request message can include information associated with the electronic ID verification and/or biometric verification, such as a confirmation data element, a biometric verification result, a mobile device identifier, and/or a digital wallet identifier. As a result, the token can be electronic ID verified and/or biometric verified upon being provisioned to the mobile device 103. For example, a token record at the token service computer 120 can indicate that the token is electronic ID verified and/or biometric verified, and/or the token record can be linked to corresponding verification records at the identification service computer 130 and/or biometric validation computer 140. In some embodiments, the token service computer 120 may determine to provision the token at least in part based on the mobile device 103 being electronic ID verified and/or biometric verified. Additionally, in some embodiments, the token service computer 120 may determine to reject the token request if the mobile device 103 is not electronic ID verified and/or biometric verified. [0180] In some embodiments, the user may initiate a transaction with an already-provisioned token (e.g., as in step 13) without having previously electronic PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 ID verified or biometric verified the token (e.g., as in steps 2-12). Accordingly, the mobile device 103 can prompt the user to select, if desired, an option to provide an electronic ID 102 and/or biometric information as a part of the transaction. At that point, steps 2-5 and/or step 9 can be performed, and then the confirmation data element and/or a biometric verification result can be passed as a part of the payment information and the included authorization request message in steps 13-15. The confirmation data element and/or biometric verification result can then be factors when determining a risk score at step 22. Additionally, the mobile device 103 can prompt the user to select, if desired, an option to persist an electronic ID verification and/or a biometric verification for consideration during future transactions. At that point, steps 6-8 and/or steps 10-12 can be performed. [0181] As discussed above with respect to steps 16-17, the token service computer 120 can detokenize the payment token. In other embodiments, any other suitable entity may detokenize the payment token instead of the token service computer 120. For example, the processing computer 170 may detokenize the payment token using a local token record database before, or the authorizing entity computer 180 may detokenize the payment token. [0182] In some embodiments, the processing computer 170 may have local account records indicating whether the token, mobile device 103, and/or digital wallet are electronic ID verified and/or biometric verified. Accordingly, the processing computer 170 may not need to communicate with the identification service computer 130 and/or biometric validation computer 140 in steps 18-21, and can instead execute a local record analysis. Additionally, in some embodiments, the token service computer 120 can store the relevant records and can provide information about electronic ID verification and/or biometric verification to the processing computer 170 as a part of steps 16-17. [0183] Regarding step 18, the processing computer 170 can communicate with the identification service computer 130 directly, or the token service computer 120 may communicate with the identification service computer 130 on behalf of the processing computer 170. Regarding step 20, the processing computer 170 can communicate with the biometric validation computer 140 directly, or the token PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 service computer 120 and/or identification service computer 130 may communicate with the biometric validation computer 140 on behalf of the processing computer 170. [0184] As discussed above with respect to steps 23-24, the processing computer 170 can send the authorization request to the authorizing entity computer 180, and the authorizing entity computer 180 can authorize the transaction. In other embodiments, the processing computer 170 can authorize the transaction instead of the authorizing entity computer 180. For example, the processing computer 170 can perform some or all of step 24 as discussed above with respect to the authorizing entity computer 180. [0185] While the above method is described with respect to payment transactions, payment tokens, and payment authorization networks, embodiments also include other type of access and authorization. Instead of a payment transaction, payment token, and a payment authorization network, the method can be used in the context of an access transaction, an access token, and an access authorization network. For example, a mobile device (which can be electronic ID verified) can similarly be utilized for gaining physical access to a restricted physical area (e.g., a building), or digital access to a remote server (e.g., a database or user account for an internet-based service). The mobile device or other credentials (e.g., token) can be similarly electronic ID verified and/or biometric verified to provide faster, more secure, and/or more reliable authorization when requesting access via the mobile device. [0186] Embodiments of the invention provide for a number of technical advantages. Using embodiments of the invention, a mobile device and/or token can be verified as owned by, in the possession of, and/or otherwise associated with an account holder. By using the mobile device to authenticate an electronic ID associated with the account holder, it can be securely verified that the account holder (e.g., of an account issued by an issuer) is also in possession of the mobile device (e.g., which is typically not provided by the issuer). Additionally, biometric authentication can further evidence that the person in possession of the mobile device (and token provisioned to the mobile device) is, in fact, the account holder. PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 The mobile device and/or token can thereby be considered bound to the user’s electronic ID and/or user biometric. As a result, future transactions conducted by the mobile device (e.g., using a token provisioned to the mobile device) can be trusted as authentically being conducted by the account holder, thereby reducing the likelihood and occurrence of fraudulent transactions. [0187] For example, a malicious actor that attempts to provision to their mobile device a token linked to another person’s payment account will not be able to establish electronic ID verification, as the malicious actor will likely not have possession of the other person’s electronic ID. Further, a malicious actor will not be able to provide biometric input that matches another person’s biometric template (e.g., as stored in an electronic ID), and therefore will not be able to establish biometric verification. It follows that a user who has established electronic ID verification and/or biometric verification at a mobile device is very likely the authentic account holder, and transactions conducted with that mobile device are very likely not a malicious actor’s attempt to violate an account or inappropriately access data. Such a transaction may be quickly and readily authorized without scrutiny, thereby improving security and processing efficiency for transaction processing systems. [0188] Additionally, while an authorizing entity may have information about a user’s identity, a network processor may not have access to user identity information. Embodiments described herein enable the network processor to receive identity information and/or identity verification for users, and thereby better evaluate transaction risk. [0189] Embodiments further advantageously protect identity information that may be considered sensitive. For example, the process for authenticating an electronic ID can be protected through encryption and other security protocols. Further, the identity information may not be shared, or may only be shared in a limited capacity. For example, the eID access control computer may only provide a confirmation data element, such as a verifiable hash value and/or digital signature, to the mobile device and/or token service computer. As a result, the mobile device and/or token service computer can be informed that the electronic ID is authentic and/or retrieve a token without exposing certain identity information. PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 [0190] Advantageously, this can be accomplished without any changes to existing identity authentication systems, without changes to existing transaction processing systems or flows, without requiring identity authentication servers and transaction processing servers to communicate with one another directly, without changes to existing hardware, and/or without compromising data security. Embodiments enable tokens and/or mobile devices to be electronic ID verified by adding identity authentication software and protocols to a mobile device, and by storing verification results for a token or mobile device at a server (e.g., a token service computer). Through these relatively minor changes to mobile devices and servers, embodiments can use an electronic ID to confidently link a mobile device to an account holder’s account, and then perform more secure and trustworthy transactions through the mobile device. [0191] Although the steps in the flowcharts and process flows described above are illustrated or described in a specific order, it is understood that embodiments of the invention may include methods that have the steps in different orders. In addition, steps may be omitted or added and may still be within embodiments of the invention. [0192] Any of the computing devices described herein may be an example of a computer system that may be used to implement any of the entities or components described above. The subsystems of such a computer system may be interconnected via a system bus. Additional subsystems include a printer, keyboard, storage device, and monitor, which is coupled to display adapter. Peripherals and input/output (I/O) devices, which couple to I/O controller, can be connected to the computer system by any number of means known in the art, such as a serial port. For example, I/O port or external interface can be used to connect the computer apparatus to a wide area network such as the Internet, a mouse input device, or a scanner. The interconnection via system bus may allow the central processor to communicate with each subsystem and to control the execution of instructions from system memory or the storage device, as well as the exchange of information between subsystems. The system memory and/or the storage device may embody a computer-readable medium. PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 [0193] As described, the inventive service may involve implementing one or more functions, processes, operations or method steps. In some embodiments, the functions, processes, operations or method steps may be implemented as a result of the execution of a set of instructions or software code by a suitably-programmed computing device, microprocessor, data processor, or the like. The set of instructions or software code may be stored in a memory or other form of data storage element which is accessed by the computing device, microprocessor, etc. In other embodiments, the functions, processes, operations or method steps may be implemented by firmware or a dedicated processor, integrated circuit, etc. [0194] Any of the software components or functions described in this application may be implemented as software code to be executed by a processor using any suitable computer language such as, for example, Java, C, C++, C#, Objective-C, Swift, or scripting language such as Perl or Python using, for example, conventional or object-oriented techniques. The software code may be stored as a series of instructions or commands on a computer readable medium for storage and/or transmission, suitable media include random access memory (RAM), a read only memory (ROM), a magnetic medium such as a hard-drive or a floppy disk, or an optical medium such as a compact disk (CD) or DVD (digital versatile disk), flash memory, and the like. The computer readable medium may be any combination of such storage or transmission devices. [0195] Such programs may also be encoded and transmitted using carrier signals adapted for transmission via wired, optical, and/or wireless networks conforming to a variety of protocols, including the Internet. As such, a computer readable medium according to an embodiment of the present invention may be created using a data signal encoded with such programs. Computer readable media encoded with the program code may be packaged with a compatible device or provided separately from other devices (e.g., via Internet download). Any such computer readable medium may reside on or within a single computer product (e.g., a hard drive, a CD, or an entire computer system), and may be present on or within different computer products within a system or network. A computer system may include a monitor, printer, or other suitable display for providing any of the results mentioned herein to a user. PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 [0196] The above description is illustrative and is not restrictive. Many variations of the invention may become apparent to those skilled in the art upon review of the disclosure. The scope of the invention can, therefore, be determined not with reference to the above description, but instead can be determined with reference to the pending claims along with their full scope or equivalents. [0197] One or more features from any embodiment may be combined with one or more features of any other embodiment without departing from the scope of the invention. [0198] A recitation of "a", "an" or "the" is intended to mean "one or more" unless specifically indicated to the contrary.

Claims

PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 WHAT IS CLAIMED IS: 1. A method comprising: receiving, by a mobile device, a communication comprising identity information from an electronic identification; transmitting, by the mobile device, an electronic ID authentication request message including the identity information to an electronic ID access control computer, thereby causing the electronic ID access control computer to authenticate the identity information; receiving, by the mobile device, an electronic ID authentication response message from the electronic ID access control computessr, the electronic ID authentication response message indicating that the electronic identification is authentic; and in response to receiving the electronic ID authentication response message, transmitting, by the mobile device, to a server computer, a registration request message indicating that the electronic identification is authentic, the registration request message including at least one of a token associated with the mobile device and a mobile device identifier associated with the mobile device, thereby causing the server computer to store a record indicating that at least one of the token and the mobile device identifier is electronic ID verified. 2. The method of claim 1, further comprising: transmitting, by the mobile device, to an access device or a resource provider computer, the token for a transaction, wherein the token is transmitted in an authorization request message to a processing computer which determines that the token is electronic ID verified, and wherein the transaction is authorized based at least in part on the token being electronic ID verified. 3. The method of claim 1, further comprising: transmitting, by the mobile device, to an access device or a resource provider computer, the token for a transaction, wherein the token is transmitted in an authorization request message to a processing computer, the processing computer determines that the token is electronic ID verified, the processing computer lowers a PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 risk score based on the token being electronic ID verified, and wherein the transaction is authorized based on the token and the risk score. 4. The method of claim 3, wherein the processing computer determines that the token is electronic ID verified by sending the token in the authorization request message to the server computer, wherein the server computer uses the token to identify the record indicating that at least one of the token and the mobile device identifier is electronic ID verified and informs the processing computer that the token is electronic ID verified. 5. The method of claim 1, wherein the token is associated with a first name, the identity information includes a second name, and further comprising: verifying, by the mobile device, that the second name matches the first name. 6. The method of claim 1, wherein the token is electronic ID verified, wherein being electronic ID verified indicates that the token is verified to be associated with a first identity indicated by the electronic ID, the token is associated with an account of a user with a second identity, and wherein the first identity matches the second identity. 7. The method of claim 1, wherein the record indicates that the each of a plurality of tokens associated with the mobile device are electronic ID verified. 8. The method of claim 1, wherein the electronic identification is a passport or a driving license, the electronic identification includes an embedded microprocessor encoded with the identity information, the electronic identification includes a printed copy the identity information, and the electronic identification does not include credentials. 9. The method of claim 1, further comprising: PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 receiving, by the mobile device, a biometric template from the electronic identification; receiving, by the mobile device, a biometric input from a user; authenticating, by the mobile device, the biometric input based on a comparison with the biometric template; and transmitting, by the mobile device, to a biometric validation computer, information indicating that biometric authentication was successful and at least one of the mobile device identifier and the token, thereby causing the biometric validation computer to store a second record indicating that at least one of the mobile device identifier and the token is biometric verified. 10. The method of claim 9, further comprising: transmitting, by the mobile device, to an access device or a resource provider computer, the token for a transaction, wherein the token is transmitted in an authorization request message to a processing computer, the processing computer determines that the token is electronic ID verified, the processing computer lowers a risk score based on the token being electronic ID verified, the processing computer determines that the token is biometric verified, the processing computer lowers the risk score based on the token being biometric verified, and wherein the transaction is authorized based on the token and the risk score. 11. The method of claim 1, wherein the electronic ID authentication response message includes a confirmation data element indicating that the electronic identification is authentic, the confirmation data element includes a hash value generated by the electronic ID access control computer based on an identification number of the electronic identification. 12. The method of claim 11, wherein the registration request message includes the confirmation data element, and the server computer verifies the confirmation data element using a public key associated with the electronic ID access control computer. PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 13. The method of claim 1, wherein the identity information includes an identification number and a cryptogram generated by the electronic identification, and the electronic ID access control computer validates the cryptogram. 14. The method of claim 1, wherein the identity information received from the electronic identification is encrypted using a public key associated with the electronic ID access control computer, and the electronic ID access control computer decrypts the identity information using a corresponding private key. 15. The method of claim 1, further comprising: transmitting, by the mobile device, to a token service computer, a token request message including a credential; and receiving, by the mobile device, from the token service computer, a token response message including the token, wherein the token is associated with the mobile device at the token service computer in response to the token being requested by the mobile device. 16. A mobile device comprising: a processor; and a computer readable medium, the computer readable medium comprising code executable by the processor to cause the processor to perform operations including: receiving a communication comprising identity information from an electronic identification; transmitting an electronic ID authentication request message including the identity information to an electronic ID access control computer, thereby causing the electronic ID access control computer to authenticate the identity information; receiving an electronic ID authentication response message from the electronic ID access control computer, the electronic ID authentication response message indicating that the electronic identification is authentic; and PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 in response to receiving the electronic ID authentication response message, transmitting, to a server computer, a registration request message indicating that the electronic identification is authentic, the registration request message including at least one of a token associated with the mobile device and a mobile device identifier associated with the mobile device, thereby causing the server computer to store a record indicating that at least one of the token and the mobile device identifier is electronic ID verified. 17. The mobile device of claim 16, wherein the operations further include: receiving a biometric template from the electronic identification; receiving a biometric input from a user; authenticating the biometric input based on a comparison with the biometric template; transmitting, by the mobile device, to a biometric validation computer, the token and information indicating that biometric authentication was successful, thereby causing the biometric validation computer to store a second record indicating that the token is biometric verified; and transmitting, by the mobile device, to an access device or a resource provider computer, the token for a transaction, wherein the token is transmitted in an authorization request message to a processing computer, the processing computer determines that the token is electronic ID verified, the processing computer lowers a risk score based on the token being electronic ID verified, the processing computer determines that the token is biometric verified, and the processing computer further lowers the risk score based on the token being biometric verified, and wherein the transaction is authorized based on the token and the risk score. 18. A system comprising: a mobile device including: a first processor; and PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 a first computer readable medium, the first computer readable medium comprising first code executable by the first processor to cause the first processor to perform first operations including: receiving a communication comprising identity information from an electronic identification; transmitting an electronic ID authentication request message including the identity information to an electronic ID access control computer; receiving an electronic ID authentication response message from the electronic ID access control computer, the electronic ID authentication response message indicating that the electronic identification is authentic; and in response to receiving the electronic ID authentication response message, transmitting, to a server computer, a registration request message indicating that the electronic identification is authentic, the registration request message including at least one of a token associated with the mobile device and a mobile device identifier associated with the mobile device; the server computer including: a second processor; and a second computer readable medium, the second computer readable medium comprising second code executable by the second processor to cause the second processor to perform second operations including: receiving the registration request message from the mobile device; and storing a record indicating that at least one of the token and the mobile device identifier is electronic ID verified; and the electronic ID access control computer including: a third processor; and a third computer readable medium, the third computer readable medium comprising third code executable by the third processor to cause the third processor to perform third operations including: PATENT Attorney Docket No.: 079900-1456769 Client Reference No.: 7847WO01 receiving the electronic ID authentication request message from the mobile device; authenticating the identity information; and transmitting the electronic ID authentication response message to the mobile device. 19. The system of claim 18, wherein the token is associated with a first name, the identity information includes a second name, and wherein the second operations further include: verifying that the second name matches the first name. 20. The system of claim 18, wherein the second operations further include: determining, based on the registration request message, that the token is associated with a first identity indicated by the electronic identification; determining that the token is associated with an account, and wherein the account is associated with a second identity; and verifying that the first identity matches the second identity, wherein the record is stored in response to verifying, and wherein the record indicates that the token is electronic ID verified.